Question DNS Vs Warp+

[Moonhorse]

Since firefox 118 there is possibility use encrypted client hello
and they recently added #encrypted-client-hello on chromium browsers too

you can check compability here : Cloudflare Browser Check

with cloudflare DOH + ech the results are

and with warp+ results are

I guess when browsing with the browser the isp cant see where you are in both cases, but wich one would you take? Would you use echi + different vpn?

in my case i would ditch warp as it uses vpn profile in phone, and replace it with trend micros vpn mode


edit: added this url here Encrypted Client Hello (ECH) Effectively Defeats Pirate Site Blocking * TorrentFreak

Cloudflare has enabled Encrypted Client Hello for all customers on free plans, which includes many pirate sites. The new privacy feature makes it impossible for Internet providers to track which websites subscribers visit. As a result, it also renders pirate site-blocking efforts useless, if both the site and the visitor have ECH enabled.

 

[blackice]

The ISP can see what IPs you are visiting no matter what you do with DNS. And they have pretty good techniques at figuring out which sites you are on when it's a host that has multiple sites. The benefit of encrypted DNS is the security of the connection to the DNS provider.

 

[Moonhorse]

The ISP can see what IPs you are visiting no matter what you do with DNS. And they have pretty good techniques at figuring out which sites you are on when it's a host that has multiple sites. The benefit of encrypted DNS is the security of the connection to the DNS provider.

So im better off with warp+ as it works like VPN does. But should normal user enable ech even they arent warp users?

 

[Digmor Crusher]

Here are my results, 1st using Chrome with no VPN and using my ISP's DNS server. The 2nd image is using Chrome again with my ISP's DNS server and a VPN. I don't get it.

 

[Moonhorse]

Here are my results using Chrome with no VPN and using my ISP's DNS.View attachment 279075View attachment 279077

I really dont understand how you get secure SNI without ech chrome:/Flag and cloudflare

 

[blackice]

So im better off with warp+ as it works like VPN does. But should normal user enable ech even they arent warp users?

I honestly am not 100% sure how much Warp obfuscates. It didn't sound like a complete VPN tunnel to me when it first launched, but I haven't tried it since. You would have to analyze your network traffic while using it to be sure.

 

[simmerskool]

more curious here, I downloaded warp for my desktop win10 and when I go to install, it starts to install and then stops and says
Another installation is in progress. You must complete
that installation before continuing this one
WTF
now I have to start digging deep and I'm not even sure what I'm looking for.
PS only running security on this hardware win10 is DeepInstinct. & Proton VPN & Mullvad are installed but not running. Mostly I go online from my VM (VMware)
PS2 my router is ubiquity & it seems to be using cloudflare dns so perhaps my system hardware software blocked warp installation...? Not going to worry about it...

 

[brambedkar59]

Correct me if I am wrong but ECH is still in drafting stage aka not finalized yet. That's like trusting alpha/beta software on a production machine.

TLS Encrypted Client Hello

This document describes a mechanism in Transport Layer Security (TLS) for encrypting a ClientHello message under a server public key. Discussion Venues This note is to be removed before publishing as an RFC. Source for this draft and an issue tracker can be found at...

datatracker.ietf.org

I would just use WARP if hiding data from ISP is the only goal. And for more privacy I would use an actual VPN.

 

[bobdoe]

Since firefox 118 there is possibility use encrypted client hello
and they recently added #encrypted-client-hello on chromium browsers too

you can check compability here : Cloudflare Browser Check

with cloudflare DOH + ech the results are

View attachment 279073


and with warp+ results are
View attachment 279074

I guess when browsing with the browser the isp cant see where you are in both cases, but wich one would you take? Would you use echi + different vpn?

in my case i would ditch warp as it uses vpn profile in phone, and replace it with trend micros vpn mode


edit: added this url here Encrypted Client Hello (ECH) Effectively Defeats Pirate Site Blocking * TorrentFreak

CFBCheck has only passed my browsers for Cloudflare and no other dns providers... I always get a fail on sni with SimpleDNSCrypt (latest Dnscrypt proxy) using various other servers and trying different options. One thing I always do is turn off dns caching... maybe Cloudflare needs that? I dunno

What might be good site or method to verify what CFBC reports?

 

[Moonhorse]

CFBCheck has only passed my browsers for Cloudflare and no other dns providers... I always get a fail on sni with SimpleDNSCrypt (latest Dnscrypt proxy) using various other servers and trying different options. One thing I always do is turn off dns caching... maybe Cloudflare needs that? I dunno

What might be good site or method to verify what CFBC reports?

I guess its only cloudflare thing, dont think any else dns have thing like this .
have you tried enabling flag #encrypted_hello_client and using other dns throught doh?

Since @Digmor Crusher used his isps dns and passed the test im not sure at all

 

[Jengo]

@Moonhorse makes me wonder why you still want to continue using Warp+ , if i were you just get a decent VPN.

 

[Moonhorse]

@Moonhorse makes me wonder why you still want to continue using Warp+ , if i were you just get a decent VPN.

I guess its the speed i like about it, it does basic vpn stuff, of course you cant change your country for unblocking something like netflix but for me it just works ( except social media , but not sure if vpn was the case)

But im aware of the warp+ limitions and im kind of deciding to either go with
- brave + dns0 + trend micro
- any other browser + adguard (dns0) + gdata

and the most reason is that i dont own bank account with internet aka credit card so i can only pay with paysafecard and most vpns dont acccept paysafe cards

i have avast vpn, but the speed of it is lame

Mulvad, f-secure are the ones i would pay for

 

[Jengo]

I guess its the speed i like about it, it does basic vpn stuff, of course you cant change your country for unblocking something like netflix but for me it just works ( except social media , but not sure if vpn was the case)

But im aware of the warp+ limitions and im kind of deciding to either go with
- brave + dns0 + trend micro
- any other browser + adguard (dns0) + gdata

and the most reason is that i dont own bank account with internet aka credit card so i can only pay with paysafecard and most vpns dont acccept paysafe cards

i have avast vpn, but the speed of it is lame

Mulvad, f-secure are the ones i would pay for

I used Avast VPN premium and my speed was great. On my 1GB fiber i get 30-40MB sec download speed.

 

[Moonhorse]

I used Avast VPN premium and my speed was great. On my 1GB fiber i get 30-40MB sec download speed.

On my 100mbs connection i get like 20mbs with avast vpn, pages are loading very slow and everything ''tutters''

with warp im getting